SECURE 2.0 401(k) Auto-Enrollment: Rules, Exemptions, and Tax Credits

Under the SECURE 2.0 Act, most 401(k) and 403(b) plans created on or after December 29, 2022 must automatically enroll eligible employees starting with plan years that begin after December 31, 2024.¹ The default flips: eligible workers are enrolled unless they opt out, contributions start between 3% and 10% of pay, and the rate escalates by one point each year until it reaches somewhere between 10% and 15%. Older plans are grandfathered, and several categories of employers and plan types are exempt entirely. Auto-enrolled employees can stop contributions at any time and can pull back everything they contributed within 90 days without the usual early-withdrawal penalty.

Which Plans Must Auto-Enroll

The mandate applies to 401(k) and 403(b) plans established on or after December 29, 2022, the day SECURE 2.0 was signed into law.² If the plan predates that day, it is grandfathered and doesn’t have to add automatic enrollment.³

What “established” means is where employers stumble. The IRS treats a plan as established the day its terms are adopted, not the day contributions start or the plan year begins. Documents signed on October 3, 2022, for a plan effective January 1, 2023 sit on the grandfathered side of the line.²

Multiple Employer Plans and Pooled Employer Plans get analyzed employer by employer. Joining an older shared plan after December 29, 2022 does not let a company inherit its pre-enactment status; the statute treats each participating employer as if it had its own plan.² The exemptions below also apply on that employer-by-employer basis.

Employers and Plans That Are Exempt

Two employer categories are carved out no matter what plan they offer. Businesses that have existed for less than three years don’t have to auto-enroll, and employers that normally have 10 or fewer employees are also exempt.³ A small employer inside a large Pooled Employer Plan still keeps its exemption.

Certain plan types are exempt regardless of the employer:

SIMPLE 401(k) plans
Church plans established and maintained by churches or church associations
Governmental plans maintained by federal, state, or local agencies
Any 401(k) or 403(b) plan established before December 29, 2022³

One boundary worth flagging: the statute has no separate carve-out for collectively bargained plans. Union-negotiated arrangements likely have to comply if none of the other exemptions fit.

Default Contribution Rate and Yearly Escalation

A plan under the mandate must set its initial automatic contribution rate at no less than 3% and no more than 10% of the employee’s compensation.³ Employees can pick a different rate or opt out at any time; the range only fixes the default.

After each completed year of participation, the rate ratchets up by one percentage point. Escalation continues until the rate reaches at least 10% and stops no higher than 15%, with the plan choosing where inside that band to cap it.¹ An employee who starts at 3% moves to 4%, then 5%, and so on. Anyone who doesn’t want the increase can set their own rate or opt out of escalation.

The mandate does not require an employer match. Whether the company matches, and how generously, is still a plan design choice.

Where Default Contributions Get Invested

An auto-enrolled employee who never picks an investment doesn’t get parked in cash. Federal rules require default contributions to go into a Qualified Default Investment Alternative, or QDIA.³ A QDIA must be managed by a registered investment company, be diversified, and cannot invest directly in employer stock. The three permitted formats are target-date funds that grow more conservative as retirement approaches, balanced funds with a fixed stock-and-bond mix, and professionally managed accounts.⁴ Target-date funds are the most common choice.

Employees can move out of the QDIA into any other option the plan offers. The plan must allow this at least once a quarter with no financial penalty.⁴

Opting Out and the 90-Day Withdrawal Window

Automatic enrollment is not forced enrollment. Any auto-enrolled employee can stop future deductions by notifying the plan administrator, usually through an online portal or a written notice to HR.

The stronger protection is the permissible withdrawal. Within 90 days of the first automatic paycheck deduction, an auto-enrolled employee can withdraw everything that was contributed plus earnings.⁵ It is a full reversal, and unlike most early distributions from a retirement account, these withdrawals are not subject to the 10% early distribution penalty.⁶

Two things to know before pulling the money out. The withdrawn amount is taxable income for the year received.⁷ And any employer matching contributions tied to those deferrals are forfeited.⁵ Miss the 90-day window and the money follows normal distribution rules, which usually means it stays in the plan until the employee leaves, reaches 59½, or qualifies for a hardship withdrawal.

Notice Employees Must Receive

Deductions can’t start without warning. A plan using an eligible automatic contribution arrangement must give eligible employees written notice 30 to 90 days before each plan year begins. For new hires enrolled immediately, the notice can be delivered on the hire date. Where it isn’t practical to provide the notice before eligibility, it must go out before the pay date covering the period when eligibility begins.⁸

The notice has to spell out the default contribution rate, how annual escalation works, the right to opt out or change the rate, and how the permissible withdrawal works. It must also identify where contributions will be invested by default if the employee doesn’t choose.⁴

Long-Term Part-Time Employees

SECURE 2.0 also widened the pool of eligible workers. Starting with plan years beginning in 2025, employees who work at least 500 hours in each of two consecutive 12-month periods and are at least 21 must be allowed into the plan.⁹ Only 12-month periods starting on or after January 1, 2021 count toward the requirement. For plans covered by the auto-enrollment mandate, qualifying part-timers must be swept in along with everyone else, which means tracking hours and eligibility for staff many employers didn’t previously factor into their retirement plan.

Tax Credits That Offset the Cost

Adding automatic enrollment to any plan, new or existing, lets an eligible employer claim a $500 tax credit each year for three years.¹⁰ It sits on top of the separate startup cost credit for creating and running a new plan.

The startup credit covers ordinary plan expenses, including employee education. Employers with 50 or fewer employees who earned at least $5,000 in the prior year can claim 100% of eligible costs; those with 51 to 100 qualifying employees can claim 50%. The annual credit is capped at the greater of $500 or $250 times the number of eligible non-highly-compensated employees, up to $5,000, and runs for three years.¹⁰ A small employer starting a new 401(k) with automatic enrollment can pull in as much as $5,500 a year for three years between the two credits.

What Happens When an Employer Doesn’t Comply

There is no standalone excise tax for skipping the auto-enrollment mandate. Failing to enroll an eligible worker is treated like any other failure to give an employee the chance to defer, which means the employer must make corrective contributions and may go through an IRS correction program.

The default correction is a qualified nonelective contribution equal to 50% of the employee’s missed deferral, calculated using the average deferral rate for the employee’s group and their compensation for the year they were excluded.¹¹ The contribution must be fully vested and comes from the employer.

Reduced corrections apply depending on how quickly the mistake gets fixed:

25% of the missed deferrals if the employee is still working, the exclusion lasted more than three months, and a special notice reaches the affected employee within 45 days of starting correct deferrals.
0% of the missed deferrals for plans with automatic enrollment features, if the employer begins correct deferrals within 9½ months after the end of the plan year the failure happened in (or by the end of the month after the employee reports the error, if sooner) and delivers the required notice within 45 days.
No missed-deferral contribution at all if the failure lasted less than three months and the employee starts participating promptly.¹¹

Even when the missed-deferral piece drops to zero, the employer still owes any matching or other employer contributions the employee would have received.¹¹ Errors caught early can often be handled through IRS self-correction at no cost. Older or larger problems go through voluntary correction, which carries user fees, and mistakes surfaced in an IRS audit generally cost the most to resolve.

1
United States Senate Committee on Finance. SECURE 2.0 Act of 2022 Section-by-Section Summary
2
Internal Revenue Service. IRS Notice 2024-02 – Miscellaneous Changes Under the SECURE 2.0 Act of 2022
3
Office of the Law Revision Counsel. 26 USC 414A – Requirements Related to Automatic Enrollment
4
U.S. Department of Labor. Fact Sheet – Default Investment Alternatives Under Participant-Directed Individual Account Plans
5
Office of the Law Revision Counsel. 26 USC 414 – Definitions and Special Rules
6
eCFR. 26 CFR 1.414(w)-1 – Permissible Withdrawals From Eligible Automatic Contribution Arrangements
7
Internal Revenue Service. Can an Employee Withdraw Any Automatic Enrollment Contributions From the Retirement Plan
8
Internal Revenue Service. FAQs Auto Enrollment – When Must an Employer Provide Notice of the Retirement Plans Automatic Contribution Arrangement to an Employee
9
Federal Register. Long-Term Part-Time Employee Rules for Cash or Deferred Arrangements Under Section 401(k)
10
Internal Revenue Service. Retirement Plans Startup Costs Tax Credit
11
Internal Revenue Service. 401(k) Plan Fix-It Guide – Eligible Employees Werent Given the Opportunity to Make an Elective Deferral Election